Remarks/Arguments : 

Rejections to the Claims pursuant to 35 USC § 1 12 

Claim 22 was rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention, in the use of the limitation "if not". 

As amendment, the claim should be clear as the claim now provides a limitation as to 
when the "if not" is triggered. 
Rejections to the Claims pursuant to 35 USC § 102 

Claims 1-14, 16-33, 35-37, 39 ,45-47, 50-53, 55, 58, 60-72, and 74-80 stand rejected 
under 35 U.S.C. 102(e) as being anticipated by Harvey et al US PGPub 2004/0252837. 

Applicant first of all notes that Applicant does not admit that the Harvey et al publication 
is prior art and reserves the right to swear behind the same at a later date. The present 
application (Serial No. 10/680,965) was filed on October 7, 2003. 

The Harvey et al publication was published on December 16, 2004, on an application 
(Serial No. 10/405,473) filed April 3, 2003. Applicant reserves the right to swear behind the 
Harvey et al publication at a later date. 

Nonetheless, in the interest of advancing the prosecution of the present application, 
Applicant respectfully submits that the elements and limitations of the claims of the present 
application can be distinguished from the teachings of the Harvey et al publication for at least the 
following reasons. 

With regards to claims 1, 13, 18-19, 22, 26, 29, 36-37, 39, 50-51, 55, 60, 62-63, 65, 68- 
69, 71, 75, Harvey et al. is cited as teaching an apparatus comprising: at least one processor; and 
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one or more media including processor-executable instructions that are capable of being 
executed by the at least one processor (Harvey, Figure 1, Figure 2), the processor-executable 
instructions adapted to direct the apparatus to perform actions comprising: monitoring at least 
one signal characteristic for a plurality of signals that relate to a single source address (Harvey, 
paragraph 0106, paragraph 0107, looks for characteristics for a particular MAC address); and 
detecting a wireless interloper if a discrepancy is determined to exist with regard to the 
monitored at least one signal characteristic for the plurality of signals (Harvey, paragraph 0107, 
location discrepancy). 

However, the detection approach described by Harvey et al. is different that Applicants 
claimed methods. Harvey et al. is primarily a disclosure of methods and systems for monitoring 
normal network operations 

Applicants have claimed an apparatus with processor-executable instructions specifically 
adapted to cause the apparatus monitor at least one signal characteristic for a plurality of signals 
that relate to a single source address. In Applicants approach, the focus is on profiling the signal 
characteristic of signals from a single source address, with the specific intent of detecting 
wireless interlopers. 

With regards to claims 2, 16, 61, 74, 78, Harvey et al., is cited as teaching processor - 
executable instructions being adapted to cause the apparatus to perform further actions 
comprising: producing a plurality of communication beams; and receiving the plurality of signals 
via at least one communication beam of the plurality of communication beams (Harvey, 
paragraphs 0025-0029). 
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However the teachings of Harvey et al. does not teach this as part of an approach with a 
focus being placed on profiling the signal characteristic of signals from a single source address, 
with the specific intent of detecting wireless interlopers. 

With regards to claims 3, 21, 28, 52, Applicant acknowledges that Harvey et al., teaches 
an apparatus with an access station or a remote client (Harvey, paragraph 0026). 

However the teachings of Harvey et al. does not teach the use of such an access station or 
remote as part of an approach with a focus being placed on profiling the signal characteristic of 
signals from a single source address, with the specific intent of detecting wireless interlopers. 

With regards to claims 4, 27, Applicant acknowledges that Harvey et al., teaches an 
apparatus that includes an antenna array having a plurality of antenna elements; and a 
beamformer coupled to the antenna array (Harvey, paragraph 0029). 

However the teachings of Harvey et al. does not teach the use of such an antenna array as 
part of an approach with a focus being placed on profiling the signal characteristic of signals 
from a single source address, with the specific intent of detecting wireless interlopers. 

With regards to claims 5, 32, Harvey et al., is cited as teaching a monitoring action 
comprising ascertaining the at least one signal characteristic for the plurality of signals (Harvey, 
paragraph 0107, location). 

However the teachings of Harvey et al., only includes a system for detecting various 
locations of the device. The reference does not teach a monitoring action comprising 
ascertaining the at least one signal characteristic for the plurality of signals, and certainly not as 
part of an approach that profiles the signal characteristic of signals from a single source address, 
with the specific intent of detecting wireless interlopers. 
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With regards to claims 6, 24-25, 30-31, 53, Harvey et al., is cited as teaching that the 
ascertaining action comprises ascertaining the at least one signal characteristic as selected from 
the group comprising: arrival delay, arrival direction, multipath offset, signal frequency, and 
signal strength. For this, paragraph 0042, is cited for showing the use of signal strength, and 
location triangulation for arrival direction. 

However the teachings of Harvey et al. does not teach the use the use of signal strength, 
and location triangulation for arrival direction as part of an approach with a focus being placed 
on profiling the signal characteristic of signals from a single source address, with the specific 
intent of detecting wireless interlopers. 

With regards to claim 7, Harvey et al. is cited as teaching the processor-executable 
instructions are adapted to cause the apparatus to perform a further action comprising: 
determining if the discrepancy exists with regard to the monitored at least one signal 
characteristic for the plurality of signals (Harvey, paragraph 0107, location discrepancy). 

However the teachings of Harvey et al. only teaches determining location of the remote 
device, and sounding an alert if it is changed beyond tolerances. Harvey et al. does not teach 
monitored at least one signal characteristic for a plurality of signals from a device as part of an 
approach for profiling the signal characteristic of signals from a single source address, with the 
specific intent of detecting wireless interlopers. 

With regards to claims 8, 20, 64, 72, Harvey et al., at paragraphs 0042 and 0107, is cited 
as teaching determining if the monitored at least one signal characteristic for a first signal of the 
plurality of signals fails to be commensurate with the monitored at least one signal characteristic 
for a second signal of the plurality of signals. 
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However, in these paragraphs the teachings of Harvey et al. only suggests the use of 
signal characteristics relating to locating a device. There is not teaching as to how this would be 
accomplished as part of monitoring at least one signal characteristic for a first signal of the 
plurality of signals fails to be commensurate with the monitored at least one signal characteristic 
for a second signal of the plurality of signals, particularly as to deciding the threshold 
characteristics that would not be sufficiently commensurate on these bases. 

Harvey et al. also does not teach such monitoring activities as part of an approach for 
profiling the signal characteristic of signals from a single source address, with the specific intent 
of detecting wireless interlopers. 

With regards to claim 9, Harvey et al. is cited as teaching, a paragraphs 0107-0108, a 
determining if a bi-modal distribution exists responsive to a predetermined threshold with regard 
to the monitored at least one signal characteristic for the plurality of signals. 

Harvey et al. also does not teach how such a bi-modal threshold would be determined as 
part of an approach for profiling the signal characteristic of signals from a single source address, 
with the specific intent of detecting wireless interlopers. 

With regards to claims 10, 14, 17, 45, 46, 58, 66, 70, 79-80, Harvey et al, at paragraphs 
0122-0123, is cited for teaching alerts raised to spoofing attacks, as part of processor-executable 
instructions adapted to cause the apparatus to perform countering the wireless interloper. 

Harvey et al. does not teach how such alerts are part of countering the wireless interloper, 
or the use of alerts as part of an approach for profiling the signal characteristic of signals from a 
single source address, with the specific intent of detecting wireless interlopers. 
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With regards to claims 1 1 and 67, paragraph 0107 of Harvey et al. is cited as teaching, 
regarding MAC addresses, a monitoring action of receiving a plurality of packets having the at 
least one signal characteristic, each packet of the plurality of packets including the single source 
address. 

Harvey et al. does not teach such a monitoring action as part of an approach for profiling 
the signal characteristic of signals from a single source address, with the specific intent of 
detecting wireless interlopers. 

With regards to claim 12, paragraphs 0122- 0123, and paragraphs 0106-0108 of Harbey 
et al. are cited as teaching detecting that two sources exist for the plurality of signals that related 
to the single source address if a discrepancy is determined to exist with regard to the monitored 
at least one signal characteristic for the plurality of signals. 

However, Harvey et al. only teaches determining if remote locations are different or have 
changed, not that detecting that two sources exist for the plurality of signals that related to the 
single source address if a discrepancy is determined to exist with regard to the monitored at least 
one signal characteristic for the plurality of signals. 

With regards to claim 23, paragraph 0107 of Harvey et al. is cited as teaching the first 
characteristic and the at least one second characteristic being spatial. 

While Harvey et al. may teach assessing changed locations for a device, this is not taught 
as part of an approach for profiling the signal characteristic of signals from a single source 
address, with the specific intent of detecting wireless interlopers. 
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With regards to claims 33, 35, 47, 76-77, paragraphs 0108, 0042, and 0127 of Harvey et | 
al. are cited as teaching storing the at least one characteristic for a packet in an entry of a table 
corresponding to a particular address. 

While Harvey et al. may teach the storing of address information, this is not taught as part 
of an approach for profiling the signal characteristic of signals from a single source address, with 
the specific intent of detecting wireless interlopers. 

For all of the above reasons it is submitted that the claims should be allowable over 
Harvey et al., and prompt acknowledgment is respectfully requested. 

Claim Rejections pursuant to 35 USC § 103 over Harvey et al in view of Chelsa 

Claims 15, 34, 38, 40-41, 48-49, 54, 56, 59, 73 stand rejected under 35 U.S.C. 103(a) as 
being unpatentable over Harvey et al US PGPub 2004/0252837 in view of Chelsa US PG Pub 
2004/0250124. 

As noted above, Applicant does not admit that the Harvey et al publication is prior art 
and reserves the right to swear behind the same at a later date. Further the Chelsa Publication is 
also not admitted to be prior art. 

The present application (Serial No. 10/680,965) was filed on October 7, 2003. The 
Chelsa publication was published on December 9, 2004, on an application (Serial No. 
1 0/44 1 ,97 1 ) filed May 1 9, 2003 . Applicant reserves the right to swear behind the Chalsa 
publication at a later date. 

Nonetheless, in the interest of advancing the prosecution of the present application, 
Applicant respectfully submits that the elements and limitations of the claims of the present 
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application can be distinguished from the teachings of the Harvey et al publication, taken with 
Chelsa, for at least the following reasons. 

With regards to claims 15, 49, 59, Harvey et al is cited as teaching the action of 
countering comprising at least one action selected from the group comprising: providing 
notification of the detected wireless interloper (Harvey, paragraphs 0122-0123, alerts raised to 
spoofing attacks); recording the ascertained at least one signal characteristic for the plurality of 
signals that relate to the single source address (Harvey, paragraphs 0108, 0042, 0127). It is 
conceded that Harvey et al. fails to teach terminating one or more communications that relate to 
the single source address. 

Chesla is cited as teaching the limitation of terminating one or more communications that 
relate to the single source address (Chesla, paragraph 0426). 

However, at the time the invention was made, it would not have been obvious to a person 
of ordinary skill in the art to utilize Chesla's method of terminating communications because 
Chesla' s methods are taught as part of a method of protecting a network from attack, not 
identifying wireless interlopers, as in the claimed methods. 

With regards to claims 34, 38, 54, 56, 73, it is conceded that the primary reference fails to 
teach increasing a packet tally at an ascertained value of the at least one characteristic at an entry 
corresponding to the particular address and the threshold comprising a number of packets. 
Chesla et al. is cited as teaching increasing a packet tally at an ascertained value of the at least 
one characteristic at an entry corresponding to the particular address and the threshold 
comprising a number of packets (Chesla, paragraph 0033). 
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However, at the time the invention was made, it would not have been obvious to a person 
of ordinary skill in the art to adapt Chesla et al.'s approach of increasing a packet tally at an 
ascertained value because Chesla' s methods are taught as part of a method of protecting a 
network from attack, not identifying wireless interlopers, as in the claimed methods. 

With regards to claims 40-41, Harvey et al. is conceded as failing to teach clearing the bi- 
modal distribution that exists with regard to the particular address; determining if the bi-modal 
distribution is presented again; and if so, detecting the interloper with regard to the particular 
address based on the re-presentation of the bi-modal distribution. Chesla et al. is cited for 
teaching clearing the bi-modal distribution that exists with regard to the particular address; 
determining if the bi-modal distribution is presented again; and if so, detecting the interloper 
with regard to the particular address based on the re-presentation of the bi-modal distribution 
(Chesla, paragraph 0032-0033, detects intrusion, then filters, then restarts detection to determine 
if filters are effective). 

However, at the time the invention was made, it would not have been obvious to a person 
of ordinary skill in the art to adapt Chesla et al.'s approach of determining if the bi-modal 
distribution is presented again; and if so, detecting the interloper with regard to the particular 
address based on the re-presentation of the bi-modal distribution, as the Chesla et al. methods are 
taught as part of a method of protecting a network from attack, not identifying wireless 
interlopers, as in the claimed methods. 

With regards to claim 48, it is conceded that Harvey et al. fails to teach recording a 
payload of the packet having the particular address, though Chesla et al. is cited as teaching 
recording a payload of the packet having the particular address (Chesla, paragraphs 0264-0265, 
records headers and payloads in buffers for analysis). 
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However, at the time the invention was made, it would not have been obvious to a person 
of ordinary skill in the art to adapt Chesla et al.'s approach of recording a payload of the packet, 
as the Chesla et al. methods are taught as part of a method of protecting a network from attack, 
not identifying wireless interlopers, as in the claimed methods. 

For all of the above reasons it is submitted that the claims should be allowable over 
Harvey et al., as taken with Chesla, et al., and prompt acknowledgment is respectfully requested. 

Claim Rejections pursuant to 35 USC § 103 over Harvey et al in view of Bardsley 

Claims 42, 43, 44, 57 stand rejected under 35 U.S.C. 103(a) as being unpatentable over 
Harvey et al US PGPub 2004/0252837 in view of Bardsley et al US Patent No. 7,308,714. 

As repeated above, Applicant does not admit that the Harvey et al publication is prior art 
and reserves the right to swear behind the same at a later date. Nonetheless, in the interest of 
advancing the prosecution of the present application, Applicant respectfully submits that the 
elements and limitations of the claims of the present application can be distinguished from the 
teachings of the Harvey et al publication, taken with Bardsley, for at least the following reasons. 

With regards to claims 42-44, 57, it is acknowledged that Harvey fails to teach applying 
an aging policy to logged characteristics for packets having the particular address. However, 
Bardsley teaches applying an aging policy to logged characteristics for packets having the 
particular address (Bardsley, column 5 lines 45-55, aging policy past 5 minutes). At the time the 
invention was made, it would not have been obvious to a person of ordinary skill in the art to 
utilize Bardsley's method of using an aging policy. 
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While Bardsley's method suggests fine tuning of attack signatures to allow detection of a 
signature of packets that occurs within a designated time window thus providing greater clarity 
of alerts to administrators (Bardsley, column 1 lines 30-50), at the time the invention was made, 
it would not have been obvious to a person of ordinary skill in the art to adapt Bardsley's to the 
claimed methods, as the Bardsley methods are taught as part of a method of refusing a denial of 
services, not in identifying wireless interlopers, as in the claimed methods. 



CONCLUSION 

In light of the above remarks, Applicant believes that the application, as amended, is in 
condition for allowance. Accordingly, the Examiner is respectfully requested to withdraw the 
outstanding rejection of the claims and to pass this application to allowance. 

This response is being filed with a fee and an extension of time to reply to the Office 
Action for 3 months, as well as a petition to revive an unintentionally abandoned application, and 
the fee appropriate thereto. Applicant authorizes any required fees requested to be charged to 
Deposit Account 50-1577. 

If the Examiner has any questions regarding this etm^municatiomMTTinvited to contact 
the undersigned at (916) 930-2585. 

Respect: iilly suhm 

Date: November 20, 2009 



Bullivant Houser Bailey PC 
1415 L Street, Suite 1000 
Sacramento, California 95814 
Tel.: (916)930-2585 
Fax: (916) 930-2501 





Carl J.lSchwedler, Rdg. No.: 36,^24 y 
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